chore(workflow): update claude.yml for main branch and enhanced secur…

[lroolle]

…ity config

[lroolle]

@claude

[claude-yolo]

Claude finished @lroolle's task —— View job

---

🚨 CRITICAL SECURITY AUDIT - BLOCKING ISSUES FOUND

Todo List:

• Read current workflow file
• Compare changes against main branch
• Analyze container security boundaries
• Review authentication flows and token handling
• Check for shell injection vulnerabilities
• Assess privilege escalation vectors
• Identify permission bypass risks
• Document blocking issues and high-risk findings
• Recommend required security tests

---

🔴 BLOCKING SECURITY ISSUES

1. COMMAND INJECTION via Hardcoded Prompt

SEVERITY: CRITICAL

Lines 57-58 inject a hardcoded security audit prompt into every PR:

printf '%s\n' "Perform a paranoid security audit of this pull request..."

Attack Vector: This forces Claude to perform security audits regardless of PR content or author intent. An attacker could:

• Create PRs specifically to trigger security scans of sensitive code
• Abuse the audit process to extract information about internal security practices
• Force resource consumption through mandatory security reviews

Mitigation Required: Remove hardcoded prompt injection. Use conditional logic based on PR labels or explicit triggers.

2. Untrusted NPM Package Execution

SEVERITY: HIGH

Lines 78-91 execute @vibeworks/barkme-mcp-server from npm:

"command": "npx",
"args": ["@vibeworks/barkme-mcp-server"]

Attack Vectors:

• Package could be compromised (supply chain attack)
• Typosquatting if package name changes
• Network-based package substitution
• Executes with workflow permissions (contents: write, pull-requests: write)

Evidence Needed: Package audit, dependency pinning, checksum verification

3. Excessive GitHub Permissions

SEVERITY: HIGH

Lines 29-32 grant broad write access:

permissions:
  contents: write      # Can modify any file
  pull-requests: write # Can modify PRs
  issues: write       # Can modify issues

Risk: Combined with NPM package execution, this creates privilege escalation path

4. Secret Exposure Risk

SEVERITY: MEDIUM

Lines 82-84 expose multiple secrets to external process:

"BARK_DEVICES": "${{ secrets.BARK_DEVICES }}"
"BARK_SERVER": "${{ secrets.BARK_SERVER }}"

Risk: If MCP server is compromised, secrets leak to attacker

---

🟡 HIGH-RISK FINDINGS

1. Migration to Different Action

Changed from thevibeworks/claude-code-action@allow-bot-actor to anthropics/claude-code-action@v1

Concerns:

• Lost allow_bot_actor security control
• New action may have different security model
• No version pinning (@v1 can change)

Required: Pin to specific commit SHA

2. Expanded Trigger Surface

Added synchronize, ready_for_review, labeled events

Risk: More attack surface for triggering workflows with malicious payloads

3. Dynamic Tool Allowlist

Line 74: --allowedTools Bash(gh:*),Bash(git:*),Bash(docker:*)...

Risk: Wildcards allow broad command execution including potentially dangerous subcommands

---

⚠️ REQUIRED SECURITY TESTS

1. Package Verification:

   npm audit @vibeworks/barkme-mcp-server
   npm view @vibeworks/barkme-mcp-server

2. Permission Testing:

   • Test workflow with minimal permissions
   • Verify secrets don't leak in logs
   • Test with malicious PR content

3. Tool Restriction Testing:

   • Verify --allowedTools restrictions work
   • Test with shell injection attempts
   • Confirm Docker commands are properly sandboxed

4. Input Validation:

   • Test with malicious GitHub event payloads
   • Verify JQ parsing is safe
   • Test prompt injection attempts

---

🛡️ SECURITY RECOMMENDATIONS

IMMEDIATE (Before Merge):

1. Remove hardcoded security audit prompt - this is a fundamental design flaw
2. Pin npm package to specific version with checksum
3. Reduce GitHub permissions to minimum required
4. Pin action to commit SHA instead of @v1

FOLLOW-UP:

1. Add secret scanning to prevent accidental exposure
2. Implement workflow approval for external PRs
3. Add input sanitization for all user-controlled data
4. Consider moving MCP server to internal/trusted package

VERDICT: 🚫 DO NOT MERGE until blocking issues are resolved.